@onlyne/lib 3.0.0 → 3.1.0

package/src/discovery.ts

@@ -1,8 +1,8 @@
-import { OnlyneError, fail, key, page, type Context } from './core.js';
-import { membershipRecord, validateDomainId } from './domains.js';
+import { OnlyneError, fail, key, page, type Context } from './core.ts';
+import { membershipRecord, validateDomainId } from './domains.ts';
 import type {
   DiscoveryCandidate, DiscoveryRecord, DomainId, Failure, NodeId, Page, PageOptions, ServiceDescription, Target,
-} from './types.js';
+} from './types.ts';
 
 /** How long candidate evidence stays current. An expired record is history, not a live address. */
 const FRESH_MS = 120_000;
@@ -25,12 +25,12 @@ function loopback(url: URL): boolean {
 }
 
 /** True for an address another host could use. Loopback, wildcard and unscoped link-local stay home. */
-function exchangeable(value: string): boolean {
+function exchangeable(value: string, allowLoopback = false): boolean {
   let url: URL;
   try { url = new URL(value); } catch { return false; }
   if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
   const host = hostOf(url);
-  if (loopback(url) || host === '0.0.0.0' || host === '::') return false;
+  if ((!allowLoopback && loopback(url)) || host === '0.0.0.0' || host === '::') return false;
   if (/^169\.254\./.test(host)) return false;
   return !(/^fe80:/.test(host) && !host.includes('%'));
 }
@@ -101,11 +101,19 @@ function published(value: unknown): ServiceDescription {
 export class DiscoveryService {
   /** Directly verified identities in this process; lets admission policies answer without nested storage work. */
   readonly #known = new Set<NodeId>();
-  constructor(private readonly ctx: Context, private readonly fetcher: (input: string | URL | Request, init?: RequestInit) => Promise<Response> = fetch) {}
+  readonly #ctx: Context;
+  readonly #fetcher: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+  constructor(ctx: Context, fetcher: (input: string | URL | Request, init?: RequestInit) => Promise<Response> = fetch) {
+    this.#ctx = ctx;
+    this.#fetcher = fetcher;
+  }
 
   /** Whether this process has directly verified this identity at least once. */
   known(node_id: NodeId): boolean { return this.#known.has(node_id); }
 
+  get #allowLoopback(): boolean { return Boolean(this.#ctx.options.plugins.allow_loopback); }
+
   /**
    * Reads `base_url`'s service description and records what it declares. A failed observation
    * keeps the last verified identity of the address and stores the failure beside it.
@@ -114,7 +122,7 @@ export class DiscoveryService {
     if (source.length === 0) fail('invalid_request', 'A discovery record needs a source.');
     const url = address(base_url);
     if (url.protocol === 'http:' && !loopback(url)) fail('unavailable', 'Plain HTTP is limited to loopback; cross-host candidates must use HTTPS.');
-    const at = this.ctx.now();
+    const at = this.#ctx.now();
     let description: ServiceDescription;
     try {
       description = published(await this.#read(url, signal));
@@ -138,25 +146,25 @@ export class DiscoveryService {
       verified_at: iso(at),
       membership: description.membership,
     };
-    await this.ctx.storage.transaction(async tx => { await tx.put(key(PREFIX, record.node_id, base_url), record); });
+    await this.#ctx.storage.transaction(async tx => { await tx.put(key(PREFIX, record.node_id, base_url), record); });
     this.#known.add(record.node_id);
     return record;
   }
 
   /** The public candidate exchange: verified, fresh and reachable from somewhere other than this host. */
   async list(options: PageOptions = {}): Promise<Page<DiscoveryCandidate>> {
-    const at = this.ctx.now();
+    const at = this.#ctx.now();
     const candidates = (await this.listRecords())
       .filter(record => record.verified_at !== undefined && record.instance_id !== ''
-        && exchangeable(record.base_url) && Date.parse(record.expires_at) > at)
+        && exchangeable(record.base_url, this.#allowLoopback) && Date.parse(record.expires_at) > at)
       .map(record => ({ node_id: record.node_id, instance_id: record.instance_id, base_url: record.base_url, last_seen: record.last_seen }))
       .sort((a, b) => order(position(a), position(b)));
-    return page(candidates, options, { kind: 'discovery', node: this.ctx.node }, position);
+    return page(candidates, options, { kind: 'discovery', node: this.#ctx.node }, position);
   }
 
   /** Every observation this node holds, expired and failed ones included. */
   async listRecords(): Promise<DiscoveryRecord[]> {
-    const rows = await this.ctx.storage.transaction(tx => tx.scan<DiscoveryRecord>(`${PREFIX}/`));
+    const rows = await this.#ctx.storage.transaction(tx => tx.scan<DiscoveryRecord>(`${PREFIX}/`));
     return rows.map(row => row.value).sort((a, b) => order(position(a), position(b)));
   }
 
@@ -188,11 +196,11 @@ export class DiscoveryService {
   /** Verified, fresh candidates that declare exactly this region. */
   async candidates(domain_id: DomainId): Promise<NodeId[]> {
     validateDomainId(domain_id);
-    const at = this.ctx.now();
+    const at = this.#ctx.now();
     const nodes = new Set<NodeId>();
     for (const record of await this.listRecords()) {
       if (record.verified_at === undefined || record.instance_id === '') continue;
-      if (Date.parse(record.expires_at) <= at || !exchangeable(record.base_url)) continue;
+      if (Date.parse(record.expires_at) <= at || !exchangeable(record.base_url, this.#allowLoopback)) continue;
       const membership = record.membership;
       if (membership === null || membership === undefined || membership.state !== 'active' || membership.domain_id !== domain_id) continue;
       nodes.add(record.node_id);
@@ -217,12 +225,12 @@ export class DiscoveryService {
     controller.signal.addEventListener('abort', () => gate.reject(controller.signal.reason), { once: true });
     const timeout = setTimeout(
       () => controller.abort(new OnlyneError('unavailable', 'The candidate description lookup timed out.')),
-      this.ctx.options.wait_ms ?? 30_000,
+      this.#ctx.options.wait_ms ?? 30_000,
     );
     let response: Response;
     try {
       response = await Promise.race([
-        this.fetcher(target, { method: 'GET', headers: { accept: 'application/json' }, signal: controller.signal }),
+        this.#fetcher(target, { method: 'GET', headers: { accept: 'application/json' }, signal: controller.signal }),
         gate.promise,
       ]);
     } catch (error) {
@@ -253,10 +261,10 @@ export class DiscoveryService {
    * candidate that has to be rediscovered, not a permanent entry.
    */
   async #failed(base_url: string, source: string, at: number, error: Failure): Promise<void> {
-    await this.ctx.storage.transaction(async tx => {
+    await this.#ctx.storage.transaction(async tx => {
       const rows = (await tx.scan<DiscoveryRecord>(`${PREFIX}/`)).filter(row => row.value.base_url === base_url);
       for (const row of rows) {
-        if (row.value.verified_at !== undefined && Date.parse(row.value.expires_at) > at) {
+        if (row.value.verified_at !== undefined) {
           await tx.put(row.key, { ...row.value, source, received_at: iso(at), error });
           continue;
         }

package/src/domains.ts

@@ -1,6 +1,6 @@
-import { fail, key, OnlyneError, page, requireValue, type Context } from './core.js';
-import { serviceBase } from './transport.js';
-import type { Auth, DomainDiscovery, DomainMembership, DomainMutation, Mutation, PageOptions, Transaction } from './types.js';
+import { fail, key, OnlyneError, page, requireValue, type Context } from './core.ts';
+import { serviceBase } from './transport.ts';
+import type { Auth, DomainDiscovery, DomainMembership, DomainMutation, Mutation, PageOptions, Transaction } from './types.ts';
 
 export function validateDomainId(value: unknown): string {
   if (typeof value !== 'string' || !/^[A-Za-z][A-Za-z0-9+.-]*:[^\s]+$/.test(value)) {
@@ -56,10 +56,13 @@ async function activeMembership(tx: Transaction, node: string): Promise<DomainMe
 }
 
 export class DomainService {
-  constructor(
-    private readonly ctx: Context,
-    private readonly fetcher: (input: string | URL | Request, init?: RequestInit) => Promise<Response> = fetch,
-  ) {}
+  readonly #ctx: Context;
+  readonly #fetcher: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+  constructor(ctx: Context, fetcher: (input: string | URL | Request, init?: RequestInit) => Promise<Response> = fetch) {
+    this.#ctx = ctx;
+    this.#fetcher = fetcher;
+  }
 
   private authenticate(auth: Auth): void {
     if (!auth.actor) fail('unauthenticated', 'Authentication is required.');
@@ -67,19 +70,19 @@ export class DomainService {
 
   private self(auth: Auth): void {
     this.authenticate(auth);
-    if (auth.actor !== this.ctx.node) fail('forbidden', 'A node may only change its own domain membership.');
+    if (auth.actor !== this.#ctx.node) fail('forbidden', 'A node may only change its own domain membership.');
   }
 
   async create(auth: Auth, mutation: Mutation): Promise<DomainMembership> {
     this.self(auth);
-    return this.ctx.mutate(auth, 'domain.create', mutation, {}, async tx => {
-      if (await activeMembership(tx, this.ctx.node)) {
+    return this.#ctx.mutate(auth, 'domain.create', mutation, {}, async tx => {
+      if (await activeMembership(tx, this.#ctx.node)) {
         fail('conflict', 'This node already belongs to a domain; leave it before creating another.');
       }
-      const domain_id = validateDomainId(`urn:onlyne:region:${this.ctx.id()}`);
+      const domain_id = validateDomainId(`urn:onlyne:region:${this.#ctx.id()}`);
       const slot = key('domain', domain_id);
       if (await tx.get(slot)) fail('id_conflict', 'The domain identifier is already recorded here.');
-      const record: DomainMembership = { domain_id, node_id: this.ctx.node, state: 'active', revision: this.ctx.id() };
+      const record: DomainMembership = { domain_id, node_id: this.#ctx.node, state: 'active', revision: this.#ctx.id() };
       await tx.put(slot, record);
       return record;
     });
@@ -96,12 +99,12 @@ export class DomainService {
   private async change(auth: Auth, id: string, state: DomainMembership['state'], mutation: DomainMutation): Promise<DomainMembership> {
     this.self(auth);
     validateDomainId(id);
-    return this.ctx.mutate(auth, `domain.${state}/${id}`, mutation, { expected_revision: mutation.expected_revision ?? null }, async tx => {
+    return this.#ctx.mutate(auth, `domain.${state}/${id}`, mutation, { expected_revision: mutation.expected_revision ?? null }, async tx => {
       const slot = key('domain', id);
       const current = await tx.get<DomainMembership>(slot);
       if (!current && state === 'left') fail('not_found', 'No membership is recorded for this domain.');
       // A node belongs to one domain. Cross-domain reach is a property of threads and ingress, not of membership.
-      const active = await activeMembership(tx, this.ctx.node);
+      const active = await activeMembership(tx, this.#ctx.node);
       if (state === 'active' && active !== undefined && active.domain_id !== id) {
         fail('conflict', 'This node already belongs to another domain; leave it first.');
       }
@@ -109,9 +112,9 @@ export class DomainService {
         fail('revision_conflict', 'The local domain membership changed.', current ? { current_revision: current.revision } : undefined);
       }
       if (current?.state === state) return current;
-      const revision = this.ctx.id();
+      const revision = this.#ctx.id();
       if (revision === current?.revision) fail('internal', 'The revision source reused the current membership revision.');
-      const record: DomainMembership = { domain_id: id, node_id: this.ctx.node, state, revision };
+      const record: DomainMembership = { domain_id: id, node_id: this.#ctx.node, state, revision };
       await tx.put(slot, record);
       return record;
     });
@@ -119,34 +122,34 @@ export class DomainService {
 
   async list(auth: Auth, options: PageOptions = {}) {
     this.authenticate(auth);
-    return this.ctx.storage.transaction(async tx => {
-      const current = await activeMembership(tx, this.ctx.node);
+    return this.#ctx.storage.transaction(async tx => {
+      const current = await activeMembership(tx, this.#ctx.node);
       const records = current === undefined ? [] : [current];
       records.sort((a, b) => a.domain_id < b.domain_id ? -1 : a.domain_id > b.domain_id ? 1 : 0);
-      return page(records, options, { kind: 'domains', node: this.ctx.node, actor: auth.actor }, row => row.domain_id);
+      return page(records, options, { kind: 'domains', node: this.#ctx.node, actor: auth.actor }, row => row.domain_id);
     });
   }
 
   async describe(auth: Auth, id: string): Promise<DomainMembership> {
     this.authenticate(auth);
     validateDomainId(id);
-    return this.ctx.storage.transaction(async tx => requireValue(await tx.get<DomainMembership>(key('domain', id))));
+    return this.#ctx.storage.transaction(async tx => requireValue(await tx.get<DomainMembership>(key('domain', id))));
   }
 
   async discover(auth: Auth, id: string, signal?: AbortSignal): Promise<DomainDiscovery> {
     this.authenticate(auth);
     validateDomainId(id);
     if ((await this.describe(auth, id)).state !== 'active') fail('not_a_member', 'This node has left the domain.');
-    const candidates = this.ctx.options.plugins.domainCandidates;
+    const candidates = this.#ctx.options.plugins.domainCandidates;
     if (!candidates) fail('unsupported_delivery', 'The host provides no domain discovery source.');
     signal?.throwIfAborted();
-    const nodes = [...new Set([this.ctx.node, ...await candidates(id)])].sort();
+    const nodes = [...new Set([this.#ctx.node, ...await candidates(id)])].sort();
     const members: DomainMembership[] = [];
     const unavailable: string[] = [];
     for (const node of nodes) {
       signal?.throwIfAborted();
       if (typeof node !== 'string' || node.length === 0) fail('invalid_request', 'Domain candidates must be node identities.');
-      if (node === this.ctx.node) {
+      if (node === this.#ctx.node) {
         const current = await this.describe(auth, id);
         if (current.state === 'active') members.push(current);
         continue;
@@ -168,7 +171,7 @@ export class DomainService {
   private async query(node: string, signal?: AbortSignal): Promise<unknown> {
     // A candidate's service description is public: it is read before any key exchange, so
     // it never goes through the signing transport (RFC 0011 §5, RFC 0017 §4).
-    const target = await this.ctx.options.plugins.resolve(node);
+    const target = await this.#ctx.options.plugins.resolve(node);
     if (target.node_id !== node) fail('unavailable', 'The resolver returned a target for another identity.');
     const base = serviceBase(target.base_url);
     const url = new URL('./description', base.href.endsWith('/') ? base.href : `${base.href}/`);
@@ -181,10 +184,10 @@ export class DomainService {
       controller.signal.addEventListener('abort', () => reject(controller.signal.reason), { once: true });
       if (controller.signal.aborted) reject(controller.signal.reason);
     });
-    timer = setTimeout(() => controller.abort(new OnlyneError('unavailable', 'Service description lookup timed out.')), this.ctx.options.wait_ms ?? 30_000);
+    timer = setTimeout(() => controller.abort(new OnlyneError('unavailable', 'Service description lookup timed out.')), this.#ctx.options.wait_ms ?? 30_000);
     try {
       const response = await Promise.race([
-        this.fetcher(url, { method: 'GET', headers: { accept: 'application/json' }, signal: controller.signal }),
+        this.#fetcher(url, { method: 'GET', headers: { accept: 'application/json' }, signal: controller.signal }),
         aborted,
       ]);
       const text = await response.text().catch(() => '');

package/src/history.ts

@@ -1,16 +1,20 @@
-import type { Auth, Conversation, Entry, HistoryMessage, HistoryQuery, LocalAttention, MessageRef, Outbound, Page, ThreadRef, Transaction } from './types.js';
-import { fail, key, page, same, type Context } from './core.js';
+import type { AttentionSettlement, Auth, Conversation, Entry, HistoryMessage, HistoryQuery, LocalAttention, MessageRef, Outbound, Page, ThreadRef, Transaction } from './types.ts';
+import { fail, key, page, same, type Context } from './core.ts';
 
 const identity = (ref: MessageRef): string => key(ref.sender, ref.id);
 const threadIdentity = (ref: ThreadRef): string => key(ref.owner, ref.id);
 
 /** A read-only projection of the records this node already holds. It performs no remote reads. */
 export class HistoryService {
-  constructor(private readonly ctx: Context) {}
+  readonly #ctx: Context;
+
+  constructor(ctx: Context) {
+    this.#ctx = ctx;
+  }
 
   async list(auth: Auth, query: HistoryQuery = {}): Promise<Page<Conversation>> {
     this.authorize(auth);
-    return this.ctx.storage.transaction(async tx => {
+    return this.#ctx.storage.transaction(async tx => {
       const conversations = await this.collect(tx);
       const selected = conversations.filter(conversation =>
         (query.thread === undefined || conversation.thread_refs.some(ref => same(ref, query.thread)))
@@ -22,7 +26,7 @@ export class HistoryService {
 
   async conversation(auth: Auth, message: MessageRef): Promise<Conversation> {
     this.authorize(auth);
-    return this.ctx.storage.transaction(async tx => {
+    return this.#ctx.storage.transaction(async tx => {
       const found = (await this.collect(tx)).find(row => same(row.id, message) || row.messages.some(item => same(item.message_ref, message)));
       if (found === undefined) fail('not_found', 'This node holds no conversation for that message.');
       return found;
@@ -37,26 +41,31 @@ export class HistoryService {
   }
 
   private authorize(auth: Auth): void {
-    if (auth.actor !== this.ctx.node) fail('forbidden', 'Conversation history belongs to this node.');
+    if (auth.actor !== this.#ctx.node) fail('forbidden', 'Conversation history belongs to this node.');
   }
 
   private async collect(tx: Transaction): Promise<Conversation[]> {
     const messages = new Map<string, HistoryMessage>();
-    const addEntry = (entry: Entry, consumed?: boolean): void => {
+    const addEntry = (entry: Entry, injected?: boolean, settlement?: AttentionSettlement): void => {
       const message_ref = { sender: entry.message.sender, id: entry.message.id };
       const id = identity(message_ref);
       const previous = messages.get(id);
+      const closed = previous?.settlement ?? settlement;
       messages.set(id, {
-        message_ref, message: entry.message, direction: entry.message.sender === this.ctx.node ? 'out' : 'in',
+        message_ref, message: entry.message, direction: entry.message.sender === this.#ctx.node ? 'out' : 'in',
         thread_ref: entry.thread_ref, seq: entry.seq, at: entry.at, delivery: previous?.delivery ?? 'received',
         ...(previous?.guarantee === undefined ? {} : { guarantee: previous.guarantee }),
-        ...(consumed === undefined ? previous?.consumption === undefined ? {} : { consumption: previous.consumption }
-          : { consumption: consumed || previous?.consumption === 'consumed' ? 'consumed' : 'pending' }),
+        // A settlement closes the row without asserting a read, so it carries no consumption.
+        ...(closed !== undefined ? { settlement: closed }
+          : injected === undefined ? previous?.consumption === undefined ? {} : { consumption: previous.consumption }
+          : { consumption: injected || previous?.consumption === 'consumed' ? 'consumed' : 'pending' }),
       });
     };
     for (const { value } of await tx.scan<Entry>('entry-ref/')) addEntry(value);
     for (const { value } of await tx.scan<LocalAttention>('inbox/')) {
-      if (value.attention.entry !== undefined && value.attention.disposition !== 'expired') addEntry(value.attention.entry, value.injected);
+      if (value.attention.entry !== undefined && value.attention.disposition !== 'expired') {
+        addEntry(value.attention.entry, value.injected, value.settlement);
+      }
     }
     const confirmed = new Set<string>();
     for (const { value } of await tx.scan<{ thread_ref: ThreadRef; seq: string; confirmed: boolean }>('consumed/')) {
@@ -71,6 +80,7 @@ export class HistoryService {
         delivery: value.state,
         ...(value.receipt === undefined ? {} : { thread_ref: value.receipt.thread_ref, seq: value.receipt.seq, guarantee: value.receipt.guarantee }),
         ...(value.error === undefined ? {} : { error: value.error }),
+        ...(previous?.settlement === undefined ? {} : { settlement: previous.settlement }),
       });
     }
     for (const row of messages.values()) {

package/src/http.ts

@@ -1,19 +1,19 @@
-import { OnlyneError, canonical, fail, same } from './core.js';
+import { OnlyneError, canonical, fail, same } from './core.ts';
 import { createHash } from 'node:crypto';
-import type { Context } from './core.js';
+import type { Context } from './core.ts';
 import type {
   Auth, DeliveryPlan, DomainMutation, Event, Grant, HandoverProbe, Json, LogQuery, Member, Message, MessageQuery,
   Mutation, PageOptions, OperationRequest, ReadScope, Resource, ResourceEvent, SendRequest,
-} from './types.js';
-import type { ThreadService } from './threads.js';
-import type { MessageService } from './messages.js';
-import type { ResourceService } from './resources.js';
-import type { DomainService } from './domains.js';
-import type { DiscoveryService } from './discovery.js';
-import type { KeyService, TrustService } from './keys.js';
-import { SIGNATURE_HEADER, bodyDigest } from './keys.js';
-import type { TrustStatement } from './types.js';
-import { validateDomainId } from './domains.js';
+} from './types.ts';
+import type { ThreadService } from './threads.ts';
+import type { MessageService } from './messages.ts';
+import type { ResourceService } from './resources.ts';
+import type { DomainService } from './domains.ts';
+import type { DiscoveryService } from './discovery.ts';
+import type { KeyService, TrustService } from './keys.ts';
+import { SIGNATURE_HEADER, bodyDigest } from './keys.ts';
+import type { TrustStatement } from './types.ts';
+import { validateDomainId } from './domains.ts';
 
 const PREFIX = '/onlyne/v3';
 const DEFAULT_BYTES = 1_048_576;
@@ -261,14 +261,18 @@ function sendRequest(request: Request, value: unknown, at: { owner: string; id:
 }
 
 function grant(value: unknown): Grant {
-  const raw = shape(value, 'grant', ['id', 'recipient', 'thread_ref', 'revision', 'acked']);
+  const raw = shape(value, 'grant', ['id', 'recipient', 'thread_ref', 'revision', 'acked', 'previous_thread_ref']);
   if (typeof raw.acked !== 'boolean') fail('invalid_request', 'grant.acked must be a boolean.');
+  const previous = raw.previous_thread_ref === undefined
+    ? undefined
+    : threadRef(raw.previous_thread_ref, 'grant.previous_thread_ref');
   return {
     id: string(raw.id, 'grant.id'),
     recipient: string(raw.recipient, 'grant.recipient'),
     thread_ref: threadRef(raw.thread_ref, 'grant.thread_ref'),
     revision: string(raw.revision, 'grant.revision'),
     acked: raw.acked,
+    ...(previous === undefined ? {} : { previous_thread_ref: previous }),
   };
 }
 
@@ -624,7 +628,14 @@ export function createHttpHandler({ ctx, threads, messages, resources, domains,
       }
 
       if (path.length === 1 && path[0] === 'threads') {
-        if (request.method === 'GET') return respond(await threads.list(auth, pageOptions(params)));
+        if (request.method === 'GET') {
+          const joined = params.get('joined');
+          if (joined !== null) {
+            if (joined !== '1') fail('invalid_request', 'joined takes the value 1.');
+            return respond(await threads.joined(auth, pageOptions(params)));
+          }
+          return respond(await threads.list(auth, pageOptions(params)));
+        }
         if (request.method === 'POST') {
           const raw = shape(await json(request, limit, rawBody), 'body', ['idempotency_key', 'retry_until', 'title', 'id', 'default']);
           if (raw.default !== undefined && typeof raw.default !== 'boolean') fail('invalid_request', 'default must be a boolean.');

package/src/index.ts

@@ -1,18 +1,18 @@
-export type * from './types.js';
-export { trustPhase } from './types.js';
-export { OnlyneError } from './core.js';
-export { OnlyneNode } from './node.js';
-export { ThreadService } from './threads.js';
-export { MessageService } from './messages.js';
-export { HistoryService } from './history.js';
-export { createResourceService } from './resources.js';
-export type { ResourceService } from './resources.js';
-export { DomainService } from './domains.js';
-export { DiscoveryService } from './discovery.js';
-export { OnlyneClient } from './client.js';
-export type { SendOutcome, SendOptions, MsgOptions } from './client.js';
-export { FetchTransport } from './transport.js';
-export type { SigningTransportOptions, SigningTrust, TrustFailure } from './transport.js';
-export { KeyService, TrustService, keyFingerprint, generateKeyMaterial, SIGNATURE_HEADER, CLOCK_SKEW_MS, EXCHANGE_RETRY_MS, REFUSED_RETRY_MS } from './keys.js';
-export { createHttpHandler } from './http.js';
-export { MemoryStorage } from './memory.js';
+export type * from './types.ts';
+export { trustPhase } from './types.ts';
+export { OnlyneError } from './core.ts';
+export { OnlyneNode } from './node.ts';
+export { ThreadService } from './threads.ts';
+export { MessageService } from './messages.ts';
+export { HistoryService } from './history.ts';
+export { createResourceService } from './resources.ts';
+export type { ResourceService } from './resources.ts';
+export { DomainService } from './domains.ts';
+export { DiscoveryService } from './discovery.ts';
+export { OnlyneClient } from './client.ts';
+export type { SendOutcome, SendOptions, MsgOptions } from './client.ts';
+export { FetchTransport } from './transport.ts';
+export type { SigningTransportOptions, SigningTrust, TrustFailure } from './transport.ts';
+export { KeyService, TrustService, keyFingerprint, generateKeyMaterial, SIGNATURE_HEADER, CLOCK_SKEW_MS, EXCHANGE_RETRY_MS, REFUSED_RETRY_MS } from './keys.ts';
+export { createHttpHandler } from './http.ts';
+export { MemoryStorage } from './memory.ts';